Chapter 8 — Computer architecture | Engineering Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Components"]
  N2["8.2 Privilege levels"]
  N3["8.3 Processes and threads"]
  N4["8.4 Caches and performance"]
  N5["8.5 Storage paths"]
  N6["8.6 Firmware"]
  N7["8.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Components"]
  N2["8.2 Privilege levels"]
  N3["8.3 Processes and threads"]
  N4["8.4 Caches and performance"]
  N5["8.5 Storage paths"]
  N6["8.6 Firmware"]
  N7["8.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Components]
    |
    v
[8.2 Privilege levels]
    |
    v
[8.3 Processes and threads]
    |
    v
[8.4 Caches and performance]
    |
    v
[8.5 Storage paths]
    |
    v
[8.6 Firmware]
    |
    v
[8.7 Case]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) explain how CPU, memory, storage and I/O shape telemetry; (2) relate processes and privilege to endpoint events; (3) reason about performance costs of sensors; (4) identify architectural sources of evidence.

8.1 Components

A computer runs instructions on a CPU, keeps working data in memory, stores files on disks and talks to the world through input/output devices. Each component can be observed: CPU use, memory regions, file writes and network packets.

Each observation point answers a different question. Process creation shows what ran; memory inspection can reveal code that never touched disk; file writes show what was changed or dropped; network packets show where data went. No single view sees everything, which is why SOCs combine endpoint, network and log data rather than relying on one source.

8.2 Privilege levels

Processors separate privileged kernel code from user programs. Endpoint detection agents often run partly in the kernel to see process creation and file activity reliably, which is powerful but means agent bugs can crash machines.

Code in the kernel can see and intercept activity that user programs cannot, including attempts to tamper with the agent itself. The same power means a faulty kernel component can halt the whole machine, so agent updates are rolled out in stages with test groups first. Engineers weigh visibility gained against the stability risk on critical servers.

8.3 Processes and threads

A process is a running program with its own memory; threads are paths of execution inside it. Endpoint telemetry records process creation, parent process and command line, which detections use heavily.

Parent–child relationships tell a story: a web server process starting a command shell is unusual and worth attention, while a user's desktop starting a browser is not. Detections that combine parent, child and command-line arguments are far more precise than ones that look at a process name alone.

8.4 Caches and performance

Sensors consume CPU cycles and memory. An agent that inspects every file write may slow a busy server. Engineers balance visibility against performance, testing on representative machines.

Inspecting every file write means intercepting it, examining it and letting it continue, which adds latency to busy disks. Agents often exclude known high-volume paths, such as database files, to reduce cost, but each exclusion is a blind spot attackers could use. Engineers test agents under realistic load and document every exclusion with its reason.

8.5 Storage paths

Logs pass from memory buffers to disk to network. A crash can lose buffered events. Knowing the path explains gaps after reboots.

Most logging systems buffer events in memory and write them in batches for efficiency. A sudden power loss or crash discards whatever was in the buffer. Forwarders may buffer again before sending across the network. Knowing where buffers sit helps an analyst explain why the last seconds before a crash are missing, rather than suspecting deletion. Forwarders with disk-backed queues lose less.

8.6 Firmware

Below the operating system lies firmware. Changes there are rarely visible to normal telemetry, so integrity checks and vendor updates matter.

Firmware runs before the operating system starts and can influence everything after it, which makes changes there especially serious. Normal endpoint agents start too late to observe much of it. Defenders rely on measured boot, vendor signature checks on updates and comparison of firmware versions against expected values across the fleet. Unexpected version differences between identical servers are investigated, not dismissed.

8.7 Case

Lindqvist's portal servers run an endpoint agent. During the burst, CPU on one server reaches 95%, mostly from the web service, not the agent; Amara checks before blaming the sensor.

Blaming the agent would have been an easy guess, since sensors are often suspected when servers slow down. Amara checks per-process CPU figures and sees the web service consuming most of it while answering the flood of login attempts. The agent's share stays small. The finding points to rate limiting on the portal rather than tuning the sensor.

Worked example

Paolo asks why the portal server lost 30 seconds of agent events at 10:06. Amara reads the agent's health log: the event buffer filled while the network link was saturated by the burst, and older events were dropped. She proposes a larger buffer and a health alert when drops occur.

Synthetic case. Servers and logs are invented.

Errors and limits

Architecture knowledge explains where data can be lost, but each product behaves differently; read vendor documentation.

Exercises

EX022 — Kernel agents. Why do many endpoint agents run partly in the kernel, and what is the risk?
Show marking criteria
Rubric: 3 = reliable visibility of process/file events; bugs can crash systems; 2 = one side; 1 = vague; 0 = none.
EX023 — Lost events. Explain the 30-second event loss at 10:06.
Show marking criteria
Rubric: 3 = buffer filled during network saturation; older events dropped; 2 = partial; 1 = agent bug guess; 0 = none.
EX024 — Performance trade. How do engineers decide how much a sensor may inspect?
Show marking criteria
Rubric: 3 = balance visibility vs CPU/memory; test on representative machines; 2 = partial; 1 = maximum always; 0 = none.

Synthesis

Architecture explains what telemetry exists, what it costs and where it can be lost.

Continue studying — chapter 08 of 50

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →